Rafael David Tinoco
Rafael David Tinoco
On your statement: >This will require some work, and can be done by a future PR. The current idea that I have in mind is to iterate over tracee's maps...
> > So my initial statement is more correct in the sense that we can do pretty much everything by probing security_bpf(). Also, if probing security_bpf_map() we would be able...
I think it would work. I like it. > If one tries to tamper this new bpf map, let's say, the FIRST call to bpf(BPF_MAP_GET_FD_BY_ID), needed for the tampering, would...
@josedonizetti thoughts ?
@josedonizetti all yours if and when you have time. Thanks :*.